Privacy Policy
This Privacy Policy explains how ServSmart, operated by White Harvest LLC dba ServSmart, collects, uses, shares, and protects information. It applies to our website (servsmart.app) and platform. Questions: contact@servsmart.app.
1. Information We Collect
Account information: first and last name, business name, email, phone number (optional), address, and login credentials.
Customer data you enter: your customers' names, contacts, addresses, properties, jobs, quotes, and invoices. You control this data; we process it on your behalf.
Payment information: processed by Stripe; we store limited details such as the last four digits and status, not full card numbers. Bank-account connections are provided by Plaid, which stores access tokens we hold in encrypted form.
SMS opt-in data: when you opt in to ServSmart account SMS, we record your consent, the mobile number provided, the timestamp, the IP address, and the exact consent language shown to you.
Communications: the content of SMS and email messages you send or receive through the platform.
Usage and device data: log data, IP address, browser type, and feature usage for security and product improvement.
2. How We Use Information
To provide, maintain, and improve the service; to process payments and billing; to send transactional messages you have opted in to receive (payment confirmations, invoice reminders, security alerts, appointment reminders, and account notifications); to provide AI-assisted features scoped to your account; to provide support; and to detect and prevent fraud or abuse.
We do not sell your personal information. We do not use one tenant's data to train models for other tenants.
4. SMS Data
ServSmart sends transactional SMS to registered tenants (account owners) who have opted in. Opting in to SMS is optional and is never a condition of creating or using a ServSmart account.
Text messaging originator opt-in data and consent are used solely to deliver the messages you asked for and to honor opt-out requests.
All the above categories exclude text messaging originator opt-in data and consent; this information won't be shared with any third parties.
You can opt out at any time by replying STOP to any message, and reply HELP for help. See our Terms of Service for the full SMS program terms.
5. AI Processing
Certain features send transaction details, message text, or job data to our AI provider to generate suggestions. This processing is per-tenant and is not used to train shared or public models. You are responsible for reviewing AI output before relying on it.
7. Data Retention
We classify every kind of data into a retention class. Some records must be kept for a legal minimum even after you ask us to delete them; personal data that the law does not require us to keep is removed. The classes are:
Financial records (kept 7 years): invoices, payments, refunds, tax records, and payment-processor transaction logs. Required by IRS 26 U.S.C. 6001, Florida Statutes 213.35, and the Bank Secrecy Act. On a deletion request these are anonymized — your name is replaced with an anonymous customer identifier — but the transaction record is preserved.
Consent and compliance records (kept at least 2 years, and at least 30 days after any opt-out): SMS opt-in consent, cookie consent, and Terms/Privacy acceptance timestamps. Required by the CAN-SPAM Act, the TCPA, and Twilio A2P messaging rules. On a deletion request the proof of consent is retained with identifiers anonymized.
Personal data (deletable on request): names, emails, phone numbers, addresses, free-text notes, and customer or property photos. On a verified deletion request this is permanently removed within 30 days.
Operational logs (kept up to 2 years): SMS and email send logs, job-history metadata, login sessions, and error logs. Retained for security and SOC 2 / PCI DSS purposes, then aged out per policy.
Audit trails (kept 7 years): actions logged by user and timestamp, including the deletion request itself, preserved for legal defensibility.
How deletion works: (1) we verify your identity by email; (2) we make a copy of your data available to you; (3) a 30-day grace period begins, during which the request can be cancelled; (4) after the grace period we permanently delete personal data and anonymize the financial and consent records the law requires us to keep; (5) we email you a deletion certificate showing what was deleted, what was retained, and why.
After account cancellation, a tenant account stays accessible in read-only mode for 30 days so you can export everything and move your number before deletion.
To request deletion of your data, email support@servsmart.app, or — if you are a customer of a business that uses ServSmart — use the Privacy page in your customer portal. Businesses can manage retention and their customers' deletion requests under Settings → Data retention & privacy.
8. Data Portability and Number Portability
Data portability. Your data is yours on every plan, at no charge. You can export your customers, jobs, invoices, conversations, photos, and a full account archive at any time from Settings → Export your data.
Number portability. Any phone number we provision for you is yours to take with you. Request its release to your own Twilio account, another carrier, or for discontinuation from Settings → Move my number, and we will release it from our account.
9. Your Rights
Depending on your location (including under GDPR and CCPA), you may have the right to access, correct, delete, or export your personal information, and to object to or restrict certain processing.
To exercise these rights, email contact@servsmart.app. For data about your own customers that you store in ServSmart, you act as the controller and we will assist you as processor.
10. Security
We use industry-standard safeguards including encryption in transit, encryption of stored secrets (such as bank tokens), row-level tenant isolation, and access controls. No system is perfectly secure, but we work to protect your data and will notify you of material breaches as required by law.
11. Children
ServSmart is for businesses and is not directed to children under 13. We do not knowingly collect data from children.
12. International Users
ServSmart is operated from the United States. If you access it from elsewhere, you consent to processing in the U.S.
13. Changes
We may update this policy; material changes will be posted here with a new date.
14. Contact
Privacy questions or requests: contact@servsmart.app. White Harvest LLC dba ServSmart.